Overview

overview

10

Static

static

10

Amnesia Launcher.exe

windows7-x64

10

Amnesia Launcher.exe

windows10-2004-x64

10

Guna.UI2.dll

windows7-x64

1

Guna.UI2.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AmnesiaLauncher.zip

  • Size

    1.2MB

  • Sample

    240110-1lnvxshff2

  • MD5

    0b0254a0a55b2f020a14ba71d7b47815

  • SHA1

    a0c3cc0a488306989c48480d35360aeb8cd57586

  • SHA256

    c61cde01da9c8ee88ebf85ebee9b76f3493deeb4ef1cab09c5b34d355a161786

  • SHA512

    5d06a15d1ebdaf321183b3e5e4aa3223b3da344e9e495cada9972abb524faeb1b788740112cd10813efcf7dac48e980c970b1df79107ebb9222d04be944c78bd

  • SSDEEP

    24576:BG8K0fqe6OQniaDrk+Vyxnzw/gGJNtQAB0txSnsAzF6T4TCUxoJ:o8f83DrTUUlJNItx/IO5UxoJ

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Amnesia Launcher.exe

    • Size

      471KB

    • MD5

      34ef25fabae38d2932f3d56f9f3f2eae

    • SHA1

      a5b7cc7ad5d8325cc52540f9676ce3b01c582d21

    • SHA256

      ba228855bc01ddb191e23035f0eaf6daa91b82a8d83c846d7deba598fb7f7883

    • SHA512

      282bdc4970d4535156d40752b433f5fd660e4fe6523020cebf278e439aac56194ef80929f885873acbdadf9c22c5ad46a05938c15a56f05b0191bbfa4ceb2447

    • SSDEEP

      6144:DEDQIvyHAs3buESIYBZSIiqZiTvs6nHFiqjd:zgs3bmf/iqgTkeZZ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      Guna.UI2.dll

    • Size

      1.9MB

    • MD5

      a6c5c5d8f6a0e33f789c1c9c070a38d6

    • SHA1

      f36efdf71e737c78e83d8d284ba03b5d5aff95f1

    • SHA256

      cf423a447e5c1dc8bc0b84ef005e2e942fa149ba4f9caf7e2f12f672cad55385

    • SHA512

      fd679781213be3b7ec6a39b2dacb2b96c356d4276e8b23995f243cbda88f56e311f2933244f50e50a27c72d664b67bb337ab0053c5e83fd934bbb67d6576a124

    • SSDEEP

      24576:sdNsB5K6Piv+Xv45K/+GEg4f7bP1/Ud4hCC18Xow1Ajg/nsad4hTaV+jXlo0HQ/F:mLbe1Ajg/nsad4FaV+j

    Score
    1/10
    behavioral3behavioral4

    • Target

      Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks